Personal Data Protection Policy (KVKK)

This English text is an informational translation. The legally binding version is the Turkish original published at /tr/kvkk. References are to Turkish legislation and have not been replaced with EU/GDPR provisions.

Last updated: [Effective date: to be completed by client]

1. Identity of the Data Controller

Under Turkish Personal Data Protection Law No. 6698 ("KVKK" or the "Law"), your personal data is processed by CN Denetim ve SMMM A.Ş. (the "Company", "CN Denetim") acting as data controller, within the scope set out below.

Company name	CN Denetim ve SMMM A.Ş.
Address	Şenlikköy Mh. Harman Sk. No:42/A D:5, Florya / Küçükçekmece / İstanbul
E-mail	info@cndenetim.com.tr
Telephone	[Telephone: to be completed by client]
KEP address (registered electronic mail)	[KEP address: to be completed by client]
VERBİS registration number	[VERBİS registration number: to be completed by client]
MERSİS number	[MERSİS number: to be completed by client]
Tax office / tax number	[Tax office and tax number: to be completed by client]
KVKK contact person	[Contact person name and contact details: to be completed by client]

2. Purpose and Scope of this Policy

This Policy sets out the rules under which personal data obtained by our Company in the course of its independent audit, certified public accountancy (SMMM), tax advisory, R&D and design centre and incentive consultancy activities is processed, stored, transferred and destroyed in accordance with the KVKK and its secondary legislation.

The Policy covers our clients and their authorised representatives, the employees whose data our clients transfer to us under payroll and personnel services, our suppliers, our business partners, our job applicants, our own employees and the visitors of our website.

3. Definitions

• Personal data: Any information relating to an identified or identifiable natural person.
• Special categories of personal data: Data listed in Article 6 of the Law, such as health data, criminal convictions and biometric data.
• Data subject: The natural person whose personal data is processed.
• Data controller: The person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
• Data processor: The person who processes personal data on behalf of the data controller, based on the authority granted by the controller.

4. Principles Observed in Processing Personal Data

Our Company acts in accordance with the following principles set out in Article 4 of the Law:

• Lawfulness and fairness,
• Being accurate and, where necessary, kept up to date,
• Being processed for specified, explicit and legitimate purposes,
• Being relevant, limited and proportionate to the purposes of processing,
• Being retained only for the period stipulated in the relevant legislation or required for the purpose of processing.

5. Categories of Personal Data Processed

Data category	Examples
Identity	Full name, Turkish ID number, tax identification number, date of birth, signature
Contact	E-mail address, telephone, address, KEP address
Client transactions and finance	Accounting and journal records, financial statements, invoice and receipt details, tax return data, bank account and IBAN details, incentive and grant application files
Professional experience	Title, role, professional chamber and licence details, authority details set out in circulars of signature
Personnel data (belonging to client employees — within payroll and social security services)	Social security registration number, salary and premium details, employment entry/exit declarations, leave and timesheet records
Employees and job applicants	CV, education details, reference details, contact details submitted with the application
Legal transactions	Powers of attorney and authorisation documents, litigation and enforcement file details, correspondence with public authorities
Transaction security	Website log records, IP address, browser information, session cookie records

Note: Whether CCTV recording takes place at the Company premises, and therefore whether visual recording data is processed, will be added to this table once confirmed as [CCTV recording: to be confirmed by client].

Special categories of personal data are processed only where strictly necessary (for example medical reports or disability allowance documents that must be submitted under legislation) and provided that the conditions in Article 6 of the Law are met; they are protected under a separate security policy.

6. Purposes of Processing Personal Data

• Providing independent audit, certified public accountancy, bookkeeping and tax advisory services,
• Preparing, monitoring and reporting R&D / design centre, technopark and other incentive and grant applications,
• Establishing, performing and monitoring contractual processes; managing quotation and pricing processes,
• Submitting tax returns, notifications and reports to the relevant public authorities,
• Managing invoicing, collection and finance/accounting processes,
• Fulfilling statutory retention, notification and disclosure obligations,
• Responding to requests and complaints received through the contact form, e-mail and telephone,
• Sending newsletters and information content on the basis of explicit consent,
• Managing information security processes and operating the website securely,
• Evaluating job applications and managing human resources processes.

7. Legal Grounds for Processing

Your personal data is processed on the basis of the following legal grounds set out in Article 5 of the Law:

• Expressly provided for by law: Tax Procedure Law No. 213 (VUK), Law No. 3568 on Certified Public Accountancy and Sworn-in Certified Public Accountancy, Turkish Commercial Code No. 6102 (TTK), Social Insurance and General Health Insurance Law No. 5510, Law No. 5549 on the Prevention of Laundering Proceeds of Crime, and the regulations of the Public Oversight, Accounting and Auditing Standards Authority (KGK).
• Necessity for the conclusion or performance of a contract: Preparing and performing advisory and audit engagement agreements.
• Fulfilment of a legal obligation: Tax return, notification and retention obligations; customer identification and suspicious transaction reporting obligations under Law No. 5549.
• Establishment, exercise or protection of a right: Retaining evidence and records in the event of a dispute.
• Legitimate interest: Information security, business continuity and measurement of service quality.
• Explicit consent: Only for consent-based activities such as newsletter subscription.

8. Transfer of Personal Data

In accordance with Articles 8 and 9 of the Law and limited to the purpose of processing, your personal data may be transferred to:

• Authorised public institutions and bodies such as the Revenue Administration (GİB), the Social Security Institution (SGK), the Ministry of Trade, KGK, MASAK (Financial Crimes Investigation Board), TÜBİTAK, KOSGEB, the Ministry of Industry and Technology and the relevant technopark management companies,
• Judicial and administrative authorities requesting information under legislation,
• Legal, IT, archiving and e-transformation service providers engaged to deliver the service (acting as data processors, under confidentiality undertakings).

Your personal data is never sold or rented to third parties for marketing purposes.

Cross-border transfer: Depending on the location of the hosting and e-mail infrastructure used by our Company, transfer abroad may occur. The service providers and server locations concerned will be listed explicitly in this section once clarified as [Service providers and countries involved in cross-border transfers: to be completed by client], and any transfer will be carried out in line with the conditions of Article 9 of the Law (standard contract, undertaking or explicit consent).

9. Retention Periods and Destruction

Your personal data is retained for the period required for the purpose of processing and for the minimum retention periods stipulated in the relevant legislation. The principal periods are:

• Tax and accounting records: 5 years under the Tax Procedure Law (VUK),
• Commercial books and documents: 10 years under the Turkish Commercial Code (TTK),
• Independent audit working papers and audit files: 10 years under KGK regulations,
• Personnel records relating to an employment relationship: for the limitation periods set out in labour and social security legislation,
• Contact form records: 2 years from the closure of the request,
• Newsletter subscription records: until the subscription is cancelled,
• Website log records: 2 years,
• Unsuccessful job applications: 1 year.

Once these periods expire, personal data is erased, destroyed or anonymised either ex officio or upon the data subject's request, in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

10. Data Security Measures

• An authorisation matrix and role-based access control, so that only personnel who need the data for their duties can access it,
• A strong password policy, session timeout limits and the use of secure session cookies,
• HTTPS/TLS encryption for access to the website and the administration panel,
• Regular backups, stored in an access-controlled environment,
• Confidentiality undertakings signed with personnel and regular awareness training,
• KVKK-compliant data processing agreements with service providers acting as data processors,
• Physical archives kept in locked areas with restricted access.

If a data breach is detected, our Company notifies the Personal Data Protection Board and the affected data subjects as soon as possible and within the period stipulated in the relevant legislation.

11. Rights of the Data Subject

Under Article 11 of the Law, by applying to our Company you have the right to:

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether the data is used in line with that purpose,
• Know the third parties in Turkey or abroad to whom the data is transferred,
• Request rectification if the data is incomplete or inaccurate,
• Request erasure or destruction under the conditions of Article 7 of the Law,
• Request that rectification, erasure and destruction be notified to third parties to whom the data was transferred,
• Object to an adverse outcome arising from analysis carried out exclusively by automated systems,
• Claim compensation if you suffer damage due to unlawful processing.

12. How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests:

• By a wet-signed petition delivered in person or through a notary to Şenlikköy Mh. Harman Sk. No:42/A D:5, Florya / Küçükçekmece / İstanbul,
• By secure electronic signature or mobile signature to [KEP address: to be completed by client],
• From the e-mail address you have previously notified to us and which is registered in our system, to info@cndenetim.com.tr.

Your application should state your full name, your signature (for written applications), your Turkish ID number, your address for notification, your e-mail and telephone details if any, and the subject of your request.

Applications are concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. Where the process entails an additional cost, the fee set out in the tariff determined by the Board may be charged. If your application is rejected, if you find the response insufficient or if no response is provided within the period, you may file a complaint with the Personal Data Protection Board within thirty days of learning the response and in any case within sixty days of the date of application.

13. Updates to this Policy

This Policy may be revised in line with legislative changes and updates to the Company's processes. The current text is always published on this page.